Skip to content
OpenAdvisories
High USN-8408-1 1 CVE

php-twig vulnerability

Published Jun 8, 2026 · Updated Jun 9, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Twig did not properly validate PHP callables when
using a source policy. An authenticated user could possibly use this issue
to execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS php-twig 3.23.0-2ubuntu0.1~esm1

Vulnerabilities 1

  • High 8.8
    CVE-2026-24425

    Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

    Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attack…

    twigphp Twig php-twig php-twig Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2026-24425